Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85683— Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL

Quick assessment

Affected
Unknown Jane Menu
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Jane Menu WordPress 插件在 1.5.1 版本之前，其某个表单处理器缺乏必要的权限（capability）和非次（nonce）验证，且该处理器可被未认证用户访问。攻击者因此可以将任意已发布的页面绑定到其指定的远程文档。插件随后会获取该文档，并将未经转义处理的 和 内容直接输出到页面中，导致未认证攻击者能够在访问该页面的任何用户（包括管理员）的浏览器中执行任意 JavaScript 代码。

CVSS 8.8 · High EPSS 0.28% · P19

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown Jane Menu < 1.5.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85683

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL
Source: CVE Program / CVE List V5
Vulnerability Description
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Jane Menu 0 ~ 1.5.1 -

II. Public POCs for CVE-2026-85683

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85683

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-21 · 53 CVEs total

CVE-2026-14556 5.4 MEDIUM HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via clie
CVE-2026-107447 5.3 MEDIUM Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP
CVE-2026-105256 5.3 MEDIUM LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter
CVE-2026-104641 5.3 MEDIUM Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Re
CVE-2026-103301 5.3 MEDIUM Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Emp
CVE-2026-101138 5.3 MEDIUM CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass
CVE-2026-104642 2.7 LOW Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verificatio
CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice
CVE-2026-110514 WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR
CVE-2026-105257 LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
CVE-2026-107127 Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
CVE-2026-107128 Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Auth
CVE-2026-107788 SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
CVE-2026-107790 WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title
CVE-2026-107789 SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
CVE-2026-108073 SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter
CVE-2026-109147 WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
CVE-2026-109926 Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation
CVE-2026-110523 WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registrati
CVE-2026-100145 Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callbac

Showing top 20 of 53 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same vendor: Unknown

V. Comments for CVE-2026-85683

No comments yet

Leave a comment